smokedworld[.]biz

PhishDestroy identifies smokedworld.biz as an active phishing domain impersonating the OKX cryptocurrency exchange to deceive users into surrendering credentials or financial data. This domain leverages visual replication of OKX branding to establish false legitimacy, creating a convincing replica of the legitimate okx.com interface. The threat actor behind this campaign registered the domain through NICENIC INTERNATIONAL GROUP CO., LIMITED on January 06, 2023, and has deployed it via IP address 172.67.190.99. The infrastructure currently shows no detections on VirusTotal (1/95 engines), indicating low immediate detection but high exploitation potential.

This domain was flagged under brand impersonation with confirmed alignment to PhishDestroy seed identifier 8a2556. Technical indicators include resolution to Cloudflare IP 172.67.190.99 and use of a Google Trust Services SSL certificate, which may mislead users into assuming authenticity. The domain’s registration predates most recent brand monitoring windows, enabling prolonged exposure. Despite zero antivirus detection at time of analysis, the combination of recent creation (Jan 2023), active hosting, and targeted impersonation elevates the risk to “under investigation” due to potential for rapid escalation.

Users who visited smokedworld.biz should immediately cease interaction with the site and check their OKX accounts for unauthorized access. Enable two-factor authentication (2FA) if not already active, and review transaction history for suspicious activity. Do not enter credentials or financial information into any page linked from smokedworld.biz. Report the domain to OKX support and local cybercrime units. Organizations should consider blocking the domain and IP 172.67.190.99 at the network perimeter. Always verify URLs via official OKX channels before engaging with login or financial prompts.